A method and network for communicating between a group of entities a text encrypted using an encryption key intrinsic to the group of entities in a network having a plurality of entities and a center

Abstract: In a network having a plurality of entities and a center, the center creates random numbers for all the combinations composed of two of entities within the network, and delivers to each entity random numbers created for the combinations involving its entity. A sender entity selects a random number corresponding to a combination of the own entity and a sending destination entity from a group of random numbers delivered to the own entity, and encrypting a communication text using an encryption key determined by the selected random number to send it to said sending destination entity. A sending destination entity selects a random number corresponding to a combination of the own entity and the sender entity from the random numbers delivered to the own entity, and decoding a cipher text received using an encryption key determined by the selected random number.

Description: The present invention relates to a communication method of using an encryption, and more particularly to a method and network for sharing between a group of communicating entities (subjects of communication such as an apparatus, a software, a man and a collection thereof) an encryption key intrinsic to the group of entities prior to the communication. In the communications of using an encryption, the security of communication contents significantly relies on the fact that only the entities which will become a sender and a receiver know an encryption key but no other entities know the encryption key, whereby a safer and more efficient encryption key sharing method is desired. The encryption key sharing method has been described in detail in the documents as listed below: R. Blom, "Non-public key distribution", CRYPTO' 82, 1982 S. Tsujii, T. Ito and K. Kurosawa, "ID-based cryptosystem using discrete logarithm problem", Elect. Lett., Vol. 23, No. 24, 1987.11. Conventionally, the encryption key sharing methods are largely classified into the following four categories, the features of which will be presented below. The first encryption key sharing method is a method in which each entity shares an encryption key with all the communication partners supposed by making individual arrangements through the communication using other encryption or by physical means. The first encryption key sharing method has a higher security, but takes much trouble when there are a great number of communication partners supposed. Since it is difficult to make arrangements for the key with indefinitely many unknown partners, the first encryption key sharing method is unsuitable for the encryption communication with such indefinitely many partners. The second encryption key sharing method is a method in which each entity creates public information based on its own secret information, registers this public information into a public tile which is freely read out but strictly managed for writing or deleting, and in making communication, calculates an encryption key to be shared from its own secret information and the partner's public information. The second encryption key sharing method allows the sharing of an encryption key with any entity by referring to the public file as necessary in making communication, and is therefore available for the encryption communication with indefinitely many partners, but requires a management system for the public file or corresponding public information. Further, in a large scale network, each entity may take much trouble in referring to the partner's public information. The third encryption key sharing method is a method in which each entity exchanges a value generated from the random numbers secretly determined, using the public information determined intrinsic to a communication path, to calculate an encryption key to be shared. The third encryption key sharing method allows simply the sharing of encryption key with any entity only by exchanging the random number information. However, prior to encryption communication, a preliminary communication for exchanging the random number must be performed, in which it is not possible to confirm the communication partner. Therefore, a so-called "impersonation" may arise to attempt to pass the approval by pretending to be another person. The fourth encryption key sharing method is a method in which the center accepts an identifier (ID) of each entity such as a name or a telephone number, generates a secret key corresponding to its ID, using a secret algorithm intrinsic to the center, and sends it to each entity, each entity calculating an encryption key to be shared from its secret key and the communication partner ID. This method is called an ID-based key sharing method, and allows for the confirmation of the communication partner. This method is further subdivided into a method of requiring preliminary communication prior to encryption communication and a method of not requiring preliminary communication. The method of requiring preliminary communication is unusable like an electronic mail capable of sending only the communication text by encryption, whereas the method of not requiring preliminary communication can be used like the electronic mail and has wider service ranges. The key sharing method of not requiring preliminary communication is expected for use in the future, and has the following features. First, as the preparation, the center determines a secret algorithm g(i, j) (where i, j is ID, and assumed to be exchangeable), and delivers gi(j) with i fixed to each entity. Where it is desired that the entities A, B share the key, A enters ID of B into its own algorithm to obtain a common key kAB. kAB = gA(B) Also, B enters ID of A into its own algorithm to obtain the same common key kAB. kAB = gB(A) However, the ID-based key sharing method of not requiring the above preliminary communication had some problems as stated below. There is a possibility that one algorithm g(i, j) which is a secret of the center may be destroyed by the collusion of a plurality of entities having gi(j). Also, since the safety relies on the mathematical affairs such as the computational complexity or the rank of matrix, the extended safety or system is difficult to attain. Further, if only one center is provided, the attack from the center can not be prevented because the center has a grasp of all the secrets. This will be further detailed. In the conventional example, it is supposed that the center is reliable or a plurality of centers which are not in collusion are provided, but nowadays when there is no public institution or system for the key sharing method, considering what the center is, the center may be possibly a company which has manufactured the key sharing method or a firm which sales the key sharing method by obtaining a permission from its manufacturing company. In such situations, it is not ensured that the center is reliable, or there are a plurality of centers which are not in collusion with one another. Accordingly, from this aspect, none of the conventional key sharing methods without preliminary communication are safe, but no safe methods in practice have been proposed. Also, the conventional key sharing methods without preliminary communication have a following problem associated with the collusion, even though the center is reliable. For example, it is supposed that the same key sharing method is adopted for A firm and B firm, and shared among a number of personnels in each of A firm and B firm. Further, it is supposed that the A firm knows that the B firm also adopts the same key sharing method, but the B firm does not know what other firms adopt the same key sharing method. If there are personnels necessary for collusion in the A firm, the secret of the center is exposed by the collusion only within the A firm, and the secret of the B firm is also exposed. As a result, the B firm is subjected to a damage such as tapping or tampering, but can not tell who is an offender. Although this situation can be resolved by providing separate secret algorithms for the A firm and the B firm, the secret communication between A and B firms is not assured. It is known from EP-A-123360 to provide a network of entities in which a unique key is used for each combination of sender entity and destination entity so that when one or more keys fall into the hands of an unauthorised person it has no consequences for the protection of the remaining combinations. A centre of the network provides each entity with a set of keys from which the required key is selected according to an identification number of the destination entity. During setting up of the connection between the sending entity and the destination entity, the identification numbers of the sender and destination entities are exchanged so that each entity can identify the appropriate key. According to the present invention there is disclosed a communication method between a predetermined number (N) of entities (i) in a network having a plurality of entities and a centre a respective encryption key (K) being provided for encrypting communication between each combination of sender entity A and destination entity B of the entities, wherein a sender entity A encrypts communication text (M) using the encryption key (K) corresponding to the combination of the sender entity and the destination entity, and said destination entity B decrypts an encrypted text (C) using the same encryption key, said method comprising the steps of: providing said entities with respective identification numbers (fi); said centre creating respective pieces of information gij which are independent of one another for all combinations composed of pairs of the predetermined number of identification numbers for said plurality of entities; said centre delivering to each entity a group Gi of pieces of information gij created for those combinations including the identification number corresponding to that entity; said sender entity selecting information g(fA)(fB) corresponding to the identification number of the destination entity from the respective group of pieces of information delivered to the sender entity, encrypting a communication text (M) using an encryption key (KAB) determined by the selected information, and sending encrypted text (C) to said destination entity; and said destination entity receiving the encrypted text, selecting information g(fB)(fA) corresponding to the identification number of the sender entity from the group of pieces of information delivered to the destination entity, and decrypting the encrypted text using an encryption key KBA determined by the selected information; where the steps of providing entities with respective identification numbers is characterized by the steps of; said centre converting one-to-one an identifier (IDi) of each entity into the respective identification number (fi) in terms of a predetermined function f(IDi); said sender entity converting an identifier IDB of said destination entity (B) into a respective identification number (fB) in terms of said predetermined function prior to said step of selecting information; and said destination entity converting the identifier IDA of said sender entity into a respective identification number (fA) in terms of said predetermined function prior to said step of selecting information. Thus, it is an advantage of the present invention to provide an encryption key sharing method which is capable of sharing a key simply and safely without requiring any preliminary communication between entities, and a communication method and system using its encryption key. Also, it is another advantage of the invention to provide an encryption key sharing method in which the encryption key that is a secret between two entities is safe against the collusion between a plurality of entities. Further, it is another advantage of the invention to provide an encryption key sharing method which is capable of simply assuring the safety of an encryption key without depending on mathematical affairs such as the computational complexity and without lowering the safety against the increased number of entities. Still further, it is another advantage of the invention to provide an encryption key sharing method which is safe against the attack from the center. Also, it is another advantage of the invention to provide an encryption key sharing method which is easy to identify an offender when a secret is leaked out. Other objectives and advantages besides those discussed above shall be apparent to those skilled in the art from the description of a preferred embodiment of the invention which follows. In the description, reference is made to accompanying drawings, which forms a part thereof, and which illustrate an example of the invention. Such example, however, is not exhaustive of the various embodiments of the invention, and therefore reference is made to the claims which follow the description for determining the scope of the invention. Fig. 1 is a block diagram showing the configuration of an encryption key sharing device according to the first embodiment. Fig. 2 is a block diagram showing the configuration of a center. Fig. 3 is an explanatory representation showing a large scale communications system. Fig. 4 is an explanatory representation showing a large scale communications system which is of hierarchical structure. Fig. 5 is a block diagram showing the configuration of an encryption key sharing device according to the second embodiment. Fig. 6 is a representation for explaining how to make an encryption key intrinsic in a communications system according to the third embodiment. Fig. 7 is a representation for explaining the group sharing of an encryption key. The preferred embodiments of the present invention will be described below with reference to the accompanying drawings. The key sharing between two entities will be first described in the first to third embodiments, and subsequently the key sharing among three or more entities will be described. [First embodiment] First, in a first embodiment, the key sharing is made in a small scale communications system (LAN computer network, etc.) with the total number of entities N = q m being equal to about several hundreds in accordance with the following procedure. 1 ○ The center makes public a function f of converting one-to-one and randomly ID into a m-digit number with base q. Further, Gi (i = 1, ... N) and £ which can satisfy the following relational expressions are generated. G1 = [g11, g12, g13, ..., g1N] G2 = [g21, g22, g23, ..., g2N] G3 = [g31, g32, g33, ..., g3N] . . GN = [gN1, gN2, gN3, ..., gNN] (gij = gji: gij is an arbitrary algorithm or a random number of b bits) £ = [G1, G2, G3, ..., GN] T 2 ○ Each entity i (i = 1 ... N) registers its own identifier IDi to the center and receives Gfi corresponding to fi = f(IDi) from the center. 3 ○ An entity A generates a common key kAB from its own IDA and IDB of an entity B in accordance with the next expression, creating a cipher text C from a message text M with its kAB as the key, and sends the cipher text C with its own IDA to the entity B. fB = f(IDB) kAB = gfAfB C = E(kAB, M): (x, y) encrypting means of y with respect to x as the key. 4 ○ The entity B generates a common key kAB from IDA sent thereto and its own IDB in accordance with the next expression and decodes the cipher text C into the message text M. fA = f(IDA) kAB = gfBfA M = D(kAB, C): D(x, y) decoding means of y with respect to x as the key. With N as large as about several hundreds, Gi can be stored in a memory having the address of 10 bits or less. Also, if the output gij is a random number of 64 bits, gij can be directly used as the key of a DES password (Data Encryption Standard) which is well known as an encryption method. In this case, C = E(x, y) as above corresponds to the DES password. Also, in a basic conversion A of the DES password, the function f added to leftmost 32 bits L is not necessarily required, and omitted herein. In this embodiment, the key sharing can be performed by an encryption device. Fig. 1 is a block diagram showing the configuration of the encryption device which stores a matrix Gfi corresponding to an entity i delivered from the center. An encryption key sharing device comprises a conversion unit 11 for converting an entity identifier IDj of communication partner into fj = f(IDj) in terms of a function f, a memory 12 for storing a matrix Gfi = [gfi1, gfi2, ..., gfiN] to output a random number gfifj of 64 bits with fj as the address, a key register 13 for storing gfifj with kij as a key, and a DES encryption circuit 14 for converting a message text M into a cipher text C using the key kij. Also, in an encryption device 10 of an entity j on the receiver end, if IDi of an entity i on the sender end is input into the conversion unit 11, fi = f(IDi) is output, and gfjfi is output from the memory 12 storing Gfj, with this fi as the address, and stored in the key register 13 with gfjfi = gfifj as the common key kij of i and j, wherein the DES encryption circuit 14 decodes the cipher text C into the message text M. Fig. 2 is a block diagram showing the configuration of a center. In the center 20, a random number generator 21 generates the random number of b bits. This may be achieved either by putting together random numbers generated in units of less than b bits to the length of b bits, or extracting the part of predetermined bits from random numbers generated in units of more than b bits. 22 is a memory for storing random numbers of b bits obtained sequentially from the random number generator 21 as gij for i as well as gji for j, for i = 1, 2, ... N, and j = 1, i + 1, ... N, and eventually storing Gi = [gi1, gi2, ... giN] for each i, so that gij = gji is satisfied for any i and j. 23 is a conversion unit for converting uniquely IDi of input entity i into fi = f(IDi) which is a m-digit number with base q in terms of a function f. The memory 22 has Gfi = [gfi1, gfi2, ... gfiN] output for fi from the conversion unit. The center 20 reads Gfi based on IDi for each entity i and delivers it. [Second embodiment] An encryption key sharing method and device according to the second embodiment will be next described. In a large scale network such as the general line, the total number of entities N is so great as to require a very large memory to store a matrix Gfi as described in the first embodiment. In this embodiment, on the contrary, when the total number of entities N is very large, any large memory is dispensed with by virtue of the following method. Fig. 3 is an explanatory representation showing a large scale communications system. Since fi = f(IDi) corresponds to the address of entity i (Fig. 3), fi of m bits is first divided into fih (h = 1 ... p) at every 1 bits (where 1xp = m) to consider the large scale communications system of Fig. 2 to be hierarchical as shown in Fig. 4. £ h as shown below is created separately for an entity with the number of personnels n = q 1 at the h-th layer. £ h = [Gh1, Gh2, Gh3, ..., Ghn] Accordingly, the key sharing procedure of Fig. 4 is stated as follows. 1 ○ The center makes public a function f of converting one-to-one and randomly ID into a m-digit number with base q. Further, Ghi (h = 1 ... p, i = 1 ... n) and £ h which can satisfy the following relational expressions with the number of layers p are generated. Gh1 = [gh11, gh12, gh13, ..., gh1n] Gh2 = [gh21, gh22, gh23, ..., gh2n] Gh3 = [gh31, gh32, gh33, ..., gh3n] . . Ghn = [ghn1, ghn2, ghn3, ..., ghnn] (ghij = ghji: ghij is an arbitrary algorithm or a random number of b bits) £ h = [Gh1, Gh2, Gh3, ..., Ghn] T 2 ○ Each entity i (i = 1 ... n) registers its own identifier IDi to the center and receives Ghfih correspondinq to fih (h = 1 ... p) where fi = f (IDi) is divided as a bit sequence each having ℓ bits from the center. 3 ○ An entity A generates kAB from its own IDA and IDB of an entity B in accordance with the next expression. The entity A creates a cipher text C as below from a message text M with kAB as the common key, and sends the cipher text C with its own IDA to the entity B. fB = f(IDB) kAB = Σ ghfAhfBh (when ghij is algorithm, Σ means the synthesis of algorithms.) C = E(kAB, M) The entity B generates a common key kAB from IDA sent thereto and its own IDB in accordance with the next expression and decodes the cipher text C. fA = f(IDA) kAB = Σ ghfBhfAh M = D(kAB, C) For example, in a large scale network where the total number of entities N is supposed to be as many as one trillion (q = 10, m = 12), with N = 10 12 to 2 40 , the large scale communications system of Fig. 3 requires a memory having the address of 40 bits, which is infeasible. However, in a large scale communications system which is of hierarchical structure as shown in Fig. 4, p = 6, if ℓ = 2, wherein it is constituted of 6 layers, with n = 10 2 to 2 7 , and is sufficient with six memories of the 7-bit address. If ℓ = 1, it is constituted of 12 layers, with n = 10 to 2 4 , and sufficient with 12 memories of the 4-bit address. If each ghij is a random number of 6 bits, the system has roughly 3834 gates and 959 gates in respective cases which can be sufficiently implemented with the C-MOS gate. Accordingly, the hierarchical structure as shown in Fig. 4 can be prepared for a sufficiently large total number of entities N. Also, with this system, it is only necessary to place further layers on previously existing layers when the value of N is required to increase, wherein the system has high extensibility (with an increase of one layer, the number of entities is increased n times). In this case, the processing for each layer is identical though the content of memory is different, and can be sufficient with the same circuit configuration. Fig. 5 is a block diagram showing the configuration of an encryption device 50 according to the second embodiment. The encryption device 50 comprises a memory 55 for storing the value fjh in which ID of entity j is converted in terms of a function f and divided as a bit sequence each having 1 bits, a memory 60 for storing Ghfjh (h = 1 ... p) corresponding to divided fjh, a synthesizer 65 for synthesizing ghfihfjh (h = 1 ... p) output corresponding to every 1 bits in accordance with EXOR or an algorithm, a key register 70 for storing the common key kij (= Σ ghfifjh), and a DES encryption circuit 75 for converting the message text M into the cipher text C using the common key kij. Hence, to share the encryption key by means of the encryption device 50 as shown in Fig. 5, Ghfih (h = 1 ... p) corresponding to fih in which the matrix Gfi corresponding to entity i delivered from the center is divided at every 1 bits are first stored in the memory 60. Then, if the IDj of entity j which becomes a communication partner is input into the memory 55, fj = f(IDj) is output, and if the value fjh which is a portion obtained by dividing a bit sequence of fj into portions each having ℓ bits is input as the address into the memory 60, ghfihfjh (h= 1 ... p) are output from the memory 60. By repeating in the synthesizer 65 the EXOR operation of new ghfihfjh and previous sum Σ ghfihfjh which is already EXOR operated and stored in the key register 70, the common key kij is generated. And the DES encryption circuit 75 converts the message text M into the cipher text C with kij as the key. [Third embodiment] An encryption key sharing method and device will be described below. The conventional key sharing method without preliminary communication has the drawback that it can not prevent the attack from one center, whereas the encryption key sharing method and device according to the third embodiment is characterized in that the key is kept private to prevent the attack. Fig. 6 is an explanatory representation showing how to make the key private in the communications system according to the third embodiment. In Fig. 6, the layers at £ 1 or higher are identical to those as explained in the second embodiment, corresponding to the general line. The entity B is considered to be a firm or a route directory. Normally, there are many layers corresponding to personnels or user directories under the entity B. Accordingly, a department for managing personnels or user directories (sub-entities) in the entity B determines £ 0 by itself and delivers it to sub-entities of B (B 1 , B 2 , ..., B s ). The sub-entities of B generate a secret key which is employed only in the B, and add it to a key KBB which is determined at £ 1 layer or higher. Thereby, B can protect the secret within the group of B from the center. In this way, the encrption device in accordance with the method of this embodiment is applicable to cases wherein a sub-entity of B on duty communicates with the sub-entities within B using the general line at £ 1 or higher by constructing the encryption device in, for example, the IC card. Also, where a branch office of B is located at P, it is protected against the attack from the center by using the general line at £ 1 or higher if £ 0 is similarly predefined. KBij = KBP + goij: when goij is an algorithm, + signifies the synthesis of algorithms. Also, the attack from the center can be prevented by the following method. It is supposed that A, B belong to a specific group, and a password which is only known to A and B can be determined. Then, A, B synthesize a value or algorithm specified from the password PWAB between A and B to the normal common key KAB. Thereby, A, B can prevent the attack from the center. KAB = KAB + g (PWAB): g(x) is an algorithm determined by x. Also, by using this, the group key sharing among three or more persons can be simply performed by sharing the password. Accordingly, for the key sharing between A and B, it is only necessary to finally make the next operation. When there is no item corresponding to the personnel number and password, the key sharing in the general line can be effected by having IDAl = IDB2 = PWAB = 0. KAB = Σ ghfAhfBh + g0AlB2 + PWAB To make this key private, the center, in delivering the encryption key sharing device 10, 50 as shown in Fig. 1 and Fig. 5, may deliver it to each entity with a space area of memory storing G0n corresponding to an intrinsic array £ 0 left. On the delivered entity side, IDj of entity may be input in the encryption device 10, 50 to generate the common key in the general line, and then the sub-entity ID or password may be further input and added to this common key. Also, in order for B to determine an intrinsic array £ 0 of B, it is only necessary to repeat the following rules (1), (2) by n·(n + 1)/2 times, which is quite simple. Also, the intensity to the collusion can be determined by the memory capacity, and is unnecessary to consider. (1) Determine arbitrarily one array element of £ 0 . (2) Arrange the determined array element at i row, j column and j row, i column. By making the key private as presented above, the attack to other entities due to the collusion between entities can be simultaneously prevented. Even with the collusion between entities, layers at £ 1 or higher are only known, wherein even if all the entities of A to Z except B are in collusion, the intrinsic array £ 0 of B is not known to be safe. Further, if the B firm with £ 0 determined is subjected to a damage such as tapping or tampering, it follows that the colluder or collusion cooperator will necessarily reside inside, so that the offender is likely to identify. Also, if the password has- been determined, it follows that the person sharing the password is an offender or a responsible person who leaks the secret, whereby the offender is also likely to identify. [Fourth embodiment] An encryption key sharing method and device according to the fourth embodiment will be described below. This embodiment has a feature of the key sharing among three entities. The key sharing procedure of this embodiment is as follows. 1 ○ The center makes public a one-way function f of converting one-to-one and randomly ID into a m-digit number with base q. Further, Gi (3) (i = 1, ... N) and £ (3) which can satisfy the following relational expressions are generated (gij = gji: gij is an arbitrary function or a random number of b bits) Gi(3) = [Gi(2), gi12, gi13, gi14, ..., gilN, gi23, gi24, ..., gi2N, gi34, ..., gi3N, . . giNN] £ (3) = [G1(3), G2(3), ..., GN(3)] T 2 ○ Each entity i (i = 1 ... N) registers its own identifier IDi to the center and receives Gfi(3) corresponding to fi = f(IDi) from the center. 3 ○ An entity A generates KABC as below from its own IDA and IDB, IDC of entities B, C in accordance with the next expression. And it creates a cipher text C from a message text M with KABC as the common key, and sends the cipher text C with IDA, IDB, IDC to the entities B, C. fB = f(IDB), fC = f(IDC) KABC = gfAfBfC C = E(KABC, M) 4 ○ An entity B generates a common key KABC from IDA, IDB, IDC sent thereto in accordance with the next expression and decodes the cipher text C. fA = f(IDA), fC = f(IDC) KABC = gfBfAfC M = D(KABC, C) 5 ○ An entity C similarly generates a common key KABC in accordance with the next expression and decodes the cipher text C. fA = f(IDA), fB = f(IDB) KABC = gfCfBfA M = D(KABC, C) This is an extended concept of the key sharing between two entities as described. Fig. 7 is an explanatory representation showing the group key sharing in the communications system. In Fig. 7, A to Z show each entity as in the embodiments 1 to 3. In attempting the key sharing among A, B and C, A shares the key with BC, B shares the key with AC, and C shares the key with AB. Because of gABC = gBAC = gCAB, A, B, C can share the key. Also, for a large total number of entities N, the hierarchical structure as shown in the second embodiment is used as follows. 1 ○ The center makes public a one-way function f of converting one-to-one and randomly the center ID into a m-dimensional horizontal vector. Further, it creates Ghi (3) (h = 1 ... p, i = 1 ... n) and £ h(3) which can satisfy the following p relational expressions as shown below, wherein Ghi(s) shows a key generation matrix up to s persons. (ghijk = ghjik = ghkji: arbitrary function or random number of b bits) Ghi(3) = [Ghi(2), ghil2, ghil3, ghil4, ..., ghiln, ghi23, ghi24, ..., ghi2n, ghi34, ..., ghi3n, . . ghinn] £ h(3) = [Gh1(3), Gh2(3), Gh3(3), ..., Ghn(3)] T , (n = q^mh) 2 ○ Each entity i (i = 1 ... N) registers its own identifier IDi to the center and receives Gfih (h = 1 ... p) corresponding to fih with fi = f(IDi) divided at every 1 bits from the center. 3 ○ An entity A generates KABC from its own IDA and IDB, IDC of entities, B, C in accordance with the next expression. And it creates a cipher text C from a message text M with KABC as the common key, and sends the cipher text C with IDA, IDB, IDC to the entities B, C. fB = f(IDB), fC = f(IDC) KABC = Σ ghfAhfBhfCh C = E(KABC, M) 4 ○ An entity B generates a common key KABC from IDA, IDB, IDC sent thereto in accorance with the next expression and decodes the cipher text C. fA = f(IDA), fC = f(IDC) KABC = Σ ghfBhfAhfCh M = D(KABC, C) 5 ○ An entity C similarly generates a common key KABC in accordance with the next expression and decodes the cipher text C. fA = f(IDA), fB = f(IDB) KABC = Σ ghfChfBhfAh M = D(KABC, C) In this case, the size of Gi increases from n to n(n + 1)/2 as compared with the key sharing between two persons. Accordingly, with the use of such a hierarchical structure, the key sharing among three persons can be implemented, like the communications system as shown in Fig. 7, by adding further p layers on the communications system having p layers composed of n entities. Accordingly, it is apparent that the group key sharing can be implemented by an encryption key sharing device similar to that as shown in Figs. 1 and 5. However, in this case, ID signifies IDs for a plurality of persons. The key sharing among s persons can be realized by placing thereon layers. However, to make the key sharing among s persons, it is necessary to give Gi(s). Since Gi(s-1) is contained in a part of Gi(s), Gi(s-1) and Gi(s) can exist simultaneously. However, Gi(s) may require a larger capacity memory than Gi(s-1), but because this system has a simple and identical processing for each layer, and the large capacity memory is readily available recently, the group key sharing device among many persons can be sufficiently realized. Also, because the key sharing method among a small number of persons and the key sharing method among a great number of persons can exist simultaneously, the device can be extended as necessary. It is needless to say that the intrinsic property of the key as shown in the third embodiment is also effective for the key sharing method among three or more persons as shown in this embodiment. Various variations for the encryption key sharing method and device of this embodiment can be made without departing from the scope as defined in the claims of the present invention. For example, in this embodiment, only one encryption key sharing method for each layer is used, but the encryption key sharing method may be different for each layer, or in a combination of conventional key sharing methods. Also, the concept of the intrinsic property of the key may be implemented by a combination of different methods or by the conventional method. Further, the encryption key and the encryption key generating algorithm which can be arbitrary may be specified by each entity or generated by the center. Also, the concept of using ID as the address, but not as the variable for the generation of encryption key, is applicable not only to the encryption key sharing method of the invention, but also to other encryption key sharing methods and encryption standards. Further, when the password between entities or the encryption key between entities is a random number, the entities can make arrangements with each other in accordance with the key delivering method having preliminary communication as shown in the conventional example. Also, the encryption key sharing device as shown in Fig. 1 or 5 can attain the higher safety if it takes the form of a computer physically protected such as an IC card. Further, for a network having a plurality of independent centers, the same encryption key sharing device can be utilized by synthesizing the encryption keys or encryption key generating algorithms for the centers within the encryption key sharing device. In procedures 3 ○, 4 ○ in each of the embodiments, the key can be altered for each cipher text in the following way after obtaining the common key KAB. 3 ○ The entity A sends R having a random number r encrypted from KAB together with its own IDA to B, and also sends C having the message text M encrypted by r to B. R = E1 (KAB, r) C = E2 (r, M) 4 ○ The entity B decodes R into r using a common key KAB generated, and decodes C into the message text M by using r. r = D2 (KAB, R) M = D1 (r, M) In this case, the encryption standards (E1, D1) and (E2, D2) may be identical. This r can be used as the group key by sending the same r to entities of two or more persons. The encryption key sharing method and device of this embodiment has the following features in contrast with the conventional key sharing method. (Preparation) The center determines a plurality of algorithms gij arbitrarily and send them to entities i, j. (Key sharing) When the entities A, B want to share the key, both A and B directly use gAB occurring at the AB-th location from its own algorithms as the common key. Thereby, the drawbacks with conventional methods can be eliminated in the following way. 1) Since one algorithm gij is in common use only for i, j, it is not broken basically by the collusion. 2) The extension of the system or safety can be made simply as shown in the second and fourth embodiments. Also, because the safety does not rely on the mathematical affairs such as the computational complexity or the rank of matrix, the simpler computational method can be chosen. Also, the value or procedure designated from the entity can be employed as the encryption key or encryption key generating procedure. 3) Any attack from the center can be prevented by having separate keys as in the third embodiment. As described above, with this system, the encryption key delivering method having the following features can be implemented without making the preliminary communication prior to the encryption communication. 1) Because the center can collectively make arrangements of the encryption key which individual entities made separately, the key sharing will result in less trouble. Also, because the encryption key is set by supposing a sufficiently large number of entities, the key sharing among indefinitely many entities is allowed without having preliminary communication. 2) The relation between ID and the encryption key is simpler because it is effected only by correspondence of the number without relying on the mathematical system. Also, the higher safety can be attained by simply increasing the memory capacity. Accordingly, if a larger memory can be used cheaply than conventionally, a safer system can be constructed simply. 3) By using the memory in hierarchical configuration, the device can be simplified. For example, when the total number of entities N is one trillion persons, with N = 10 12 = 2 40 in Fig. 3, a memory having the address of 40 bits is required and can not be realized. However, the memory results in the hierarchical structure (mh = 2, P = 6) as shown in Fig. 3, with n = 10 2 = 2 7 , wherein 6 memories of the 7-bit address may be sufficient, and the key sharing among one trillion persons can be effected in small circuit scale. 4) The key can be made private because each entity has an individual layer. If a certain entity determines a private key generating array for the layers under its own entity as shown in Fig. 6, the common key can be generated completely from other entities and centers. 5) Furthermore, because the hierarchical structure and the private property can be used for the extended total number of entities and the group key sharing, the flexible encryption key sharing system can be constructed.

Claims: A communication method between a predetermined number N of entities i in a network having a plurality of entities (10) and a centre (20), a respective encryption key (K) being provided for encrypting communication between each combination of sender entity (A) and destination entity (B) of the entities, wherein a sender entity (A) encrypts communication text (M) using the encryption key (K) corresponding to the combination of the sender entity and the destination entity, and said destination entity (B) decrypts an encrypted text (C) using the same encryption key, said method comprising the steps of: providing said entities with respective identification numbers fi; said centre creating respective pieces of information gij which are independent of one another for all combinations composed of pairs of the predetermined number of identification numbers for said plurality of entities; said centre delivering to each entity a group Gi of pieces of information gij created for those combinations including the identification number corresponding to that entity; said sender entity selecting information g(fA)(fB) corresponding to the identification number of the destination entity from the respective group of pieces of information delivered to the sender entity, encrypting a communication text (M) using an encryption key KAB determined by the selected information, and sending encrypted text (C) to said destination entity; and said destination entity receiving the encrypted text, selecting information g(fB)(fA) corresponding to the identification number of the sender entity from the group of pieces of information delivered to the destination entity, and decrypting the encrypted text using an encryption key KBA determined by the selected information; where the step of providing entities with respective identification numbers is characterised by the steps of; said centre converting one-to-one an identifier (IDi) of each entity into the respective identification number fi in terms of a predetermined function f(IDi); said sender entity converting an identifier IDB of said destination entity B into a respective identification number (fB) in terms of said predetermined function prior to said step of selecting information; and said destination entity converting the identifier IDA of said sender entity into a respective identification number (fA) in terms of said predetermined function prior to said step of selecting information. A method according to claim 1, further comprising the step of each entity i storing for each identification number fj a piece of information gfij created for the combination of identification numbers involving its identification number fi in a memory (12) at an address fij corresponding to its identification number. A method according to claim 1, wherein each of said pieces of information created for all the combinations composed of pairs of the predetermined number of entities consists of a second predetermined number ℓ of bits; said identification number fi of each entity is divided by said centre as a bit sequence into portions fih each having the second predetermined number of bits; said group of pieces of information delivered to each entity is a group of pieces of information created for the combinations involving values of the portions into which the identification number is divided; said identification number of said destination entity is divided as a bit sequence into portions each having the second predetermined number of bits by said sender entity; said information selected by said sender entity is a set of information which corresponds to a value of respective portions into which the identification number of said destination entity is divided; said identification number of said sender entity is divided as a bit sequence into portions each having the second predetermined number of bits by said destination entity; and said information selected by said destination entity is a set of information which corresponds to a value of respective portions into which the identification number of said sender entity is divided. A method according to any preceding claim wherein each of said pieces of information is a number including a third predetermined number of randomly determined bits. A method according to claim 4, wherein said encryption key is said selected information. A method according to claim 1, 2 or 3 wherein each of said pieces of information is information for designating an algorithm. A method according to claim 3, wherein each of said pieces of information is a random number including a third predetermined number of bits and said encryption key is a sum of random numbers each of which is selected for a respective portion of said identification number. A method according to any of claims 1 to 7, wherein an entity has a plurality of sub-entities, and in the communication between sub-entities, an encryption key is determined by further using private information between said sub-entities. A method according to any of claims 1 to 7, wherein an entity has a plurality of sub-entities, and in the communication between sub-entities of specific two entities, an encryption key is determined by further using private information between said specific two entities. A method according to claim 9, wherein said private information is a password determined between specific two entities. A method according to claim 8 or 9, wherein said private information is an identifier of each sub-entity. A communication method according to any preceding claim, wherein said predetermined number of entities is more than two, and each of said predetermined number of entities converts identifiers of other entities into identification numbers thereof in terms of said predetermined function and said information is selected corresponding to a combination of the identification numbers obtained by conversion. A communication network having a plurality of entities (10) and a centre (20), a respective encryption key K being provided for encrypting communication between each combination of sender entity A and destination entity B of the entities, wherein a sender entity A is operable to encrypt a communication text (M) using the encryption key (K) corresponding to a combination of the sender entity and a destination entity, and said destination entity is operable to decrypt encrypted text (C) using the encryption key corresponding to a combination of the destination entity and the sender entity, said centre comprising: identification number means operable to provide entities with respective identification numbers fi; creating means (21, 22) operable to create pieces of information gij which are independent of one another for all combinations composed of pairs of the predetermined number of identification numbers for said plurality of entities; and delivering means operable to deliver to each entity a group Gi of pieces of information created for the combinations including the identification number corresponding to that entity; said each entity comprising: sender means operable to select information g(FA)(FB) corresponding to the identification number of the destination entity from the group of pieces of information delivered to the sender entity, to encrypt a communication text (M) using an encryption key KAB determined by selected information, and send encrypted text (C) to said destination entity; and receiver means operable to receive the encrypted text, to select information corresponding to the identification number of the sending entity from the group of pieces of information delivered to the destination entity, and decrypt the encrypted text using an encryption key determined by the selected information; characterised by; said centre comprising conversion means (23) operable to convert one-to-one an identifier of each entity into a respective identification number (fi) in terms of a predetermined function f(IDi); said sender means being operable prior to selecting information to convert an indentifier IDB of said destination entity (B) into the identification number (FB) thereof in terms of said predetermined function; and said receiver means being operable prior to selecting information to convert the identifier of said sender entity into the identification number thereof in terms of said predetermined function. A network according to claim 13, further comprising storage means (12) operable to store for each identification number pieces of information created for the combination involving its identification number at an address corresponding to its identification number. A network according to claim 13, wherein said pieces of information are created for all the combinations composed of the predetermined number of components each consisted of a second predetermined number of bits; said identification number of each entity is divided as a bit sequence into portions each having the second predetermined number of bits by said centre; said group of pieces of information delivered to each entity are a group of pieces of information created for the combinations involving values of the portions into which the identification number is divided; said identification number of said destination entity is divided as a bit sequence into portions each having the second predetermined number of bits by said sender means; said information selected by said sender entity is a set of information which corresponds to a value of respective portions into which the identification number of said destination entity is divided; said identification number of said sender entity is divided as a bit sequence into portions each having the second predetermined number of bits by said receiver means; and said information selected by said receiver means is a set of information which corresponds to a value of respective portions into which the identification number of said sender entity is divided. A network according to claim 13, 14 or 15, wherein each of said pieces of information is a number including a predetermined number of randomly determined bits. A network according to claim 16, wherein said encryption key is said selected information. A network according to claim 13 to 15, wherein each of said pieces of information is information for designating an algorithm. A network according to claim 15, wherein each of said pieces of information is a random number including a third predetermined number of bits and said encryption key is a sum of random numbers each of which is information selected for a respective portion of said identification number. A network according to any of claims 13 to 19, wherein an entity has plurality of sub-entities, and in the communication between sub-entities, an encryption key is determined by further using private information between said sub-entities. A network according to any of claims 13 to 19, wherein an entity has a plurality of sub-entities, and in the communication between sub-entities of specific two entities, an encryption key is determined by further using private information between said specific two entities. A network according to claim 21, wherein said private information is a password determined between specific two entities. A network according to claim 20 or 21, wherein said private information is an identifier of each sub-entity. A network according to any of claims 13 to 23, wherein said predetermined number of entities is more than two, and said sender means and said receiver means convert identifiers of other entities into identification numbers thereof in terms of said predetermined function and select said information corresponding to a combination of the identification numbers obtained by conversion.

Inventors: IWAMURA KEIICHI, YAMAMOTO TAKAHISA, IWAMURA, KEIICHI, YAMAMOTO, TAKAHISA, IWAMURA, KEIICHI, C/O CANON KABUSHIKI KAISHA, YAMAMOTO, TAKAHISA, C/O CANON KABUSHIKI KAISHA
Applicants: CANON KK, CANON KABUSHIKI KAISHA
Application year: 1994
Main classification: H04L9
IPC codes: H04L9, G06F13, G09C1, G06F12